Improper input validation in Gehealthcare Apexpro Telemetry Server
CVE-2020-6963
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilized hard coded SMB credentials, which may allow an attacker to remotely execute arbitrary code.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.027 (85.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 86th percentile — 85.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.027 · newest: 0.027 · change: 0.000
Affected products
- Gehealthcare Apexpro Telemetry Server
- Gehealthcare Apexpro Telemetry Server Firmware
- Gehealthcare Carescape Central Station Mai700
- Gehealthcare Carescape Central Station Mai700 Firmware — versions 1.0
- Gehealthcare Carescape Central Station Mas700
- Gehealthcare Carescape Central Station Mas700 Firmware — versions 1.0
- Gehealthcare Carescape Telemetry Server Mp100r
- Gehealthcare Carescape Telemetry Server Mp100r Firmware
- Gehealthcare Clinical Information Center Mp100d
- Gehealthcare Clinical Information Center Mp100d Firmware — versions 4.0, 5.0
Weakness classification (CWE)
References
- www.us-cert.gov/ics/advisories/icsma-20-023-01 (US Government Resource, Third Party Advisory)
- www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness… (Product)
Frequently asked questions
- What is CVE-2020-6963?
- CVE-2020-6963 is a critical-severity vulnerability in Gehealthcare Apexpro Telemetry Server, classified under Use of Hard-coded Credentials. CVSS score: 10.0/10. Published 2020-01-24.
- How severe is CVE-2020-6963?
- Critical severity. CVSS v3 base score is 10.0 out of 10.